Many applications, such as CuteFTP and Outlook Express, allows you to enter a password
and use it when it is needed. However, if you forget your password, you cannot see it,
because it's hidden behind asterisks ('****') characters.
The following code snippet scans all windows on the screen and reveals the passwords
behind the asterisks characters.
This code sample works properly only on Windows 95,98,ME and NT. If you want to reveal
a password in Windows 2000 or Windows XP, download the AsterWin utility.
If you want to reveal a password behind asterisks in Internet Explorer, download the AsterWin IE utility
Also be aware that this utility will not work with applications that don't store the
password behind the asterisks, such as User Manager in Windows NT.

'Password Revealer'Copyright (c) 2002 Nir Sofer'Web site: http://nirsoft.mirrorz.com''The following code sample scans all opened windows, and reveals the passwords'behind the password text-boxes (with asterisks '***').'This code sample works properly only on Windows 95/98/ME/NT. It doesn't work on Windows 2000/XP.'
Public Declare Function EnumWindows Lib "user32" _
(ByVal lpEnumFunc As Long, ByVal lParam As Long) As Long
Public Declare Function EnumChildWindows Lib "user32" _
(ByVal hWndParent As Long, ByVal lpEnumFunc As Long, ByVal lParam As Long) As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" _
(ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Public Type POINTAPI
x As Long
y As Long
End Type
Public Type MSG
hwnd As Long
message As Long
wParam As Long
lParam As Long
time As Long
pt As POINTAPI
End Type
Public Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" _
(ByVal hwnd As Long, ByVal nIndex As Long) As Long
Public Const GWL_STYLE = (-16)
Public Const ES_PASSWORD = &H20&
Public Const EM_SETPASSWORDCHAR = &HCC
Public Declare Function InvalidateRect Lib "user32" _
(ByVal hwnd As Long, lpRect As Any, ByVal bErase As Long) As Long
Public Declare Function UpdateWindow Lib "user32" _
(ByVal hwnd As Long) As Long
Public Function EnumChildWindowsProc(ByVal hwnd As Long, ByVal lParam As Long) As Long
If (GetWindowLong(hwnd, GWL_STYLE) And ES_PASSWORD) <> 0 Then
'Clear the password character
SendMessage hwnd, EM_SETPASSWORDCHAR, 0, 0
'Repaint the window
InvalidateRect hwnd, ByVal 0, 0
UpdateWindow hwnd
End If
EnumChildWindowsProc = 1
End Function
Public Function EnumWindowsProc(ByVal hwnd As Long, ByVal lParam As Long) As Long
'Enumerating all child windows.
EnumChildWindows hwnd, AddressOf EnumChildWindowsProc, 0
EnumWindowsProc = 1
End Function
Public Sub EnumPasswords()
'Enumerating all top-level windows.
EnumWindows AddressOf EnumWindowsProc, 0
End Sub